HTTP Security Headers

Strict-Transport-Security (HSTS)

Tells the browser to remember that this site is HTTPS-only, so it upgrades every future request to TLS automatically and refuses to connect over plain HTTP.

What it is

Strict-Transport-Security (HSTS, RFC 6797) tells the browser that the site must only be accessed over HTTPS. Once a browser sees the header on a valid HTTPS response, it caches the rule for max-age seconds and will automatically rewrite any http:// request to https:// — even before sending it — and refuse to bypass certificate errors.

Only honored over HTTPS

Browsers ignore the HSTS header if it arrives over plain HTTP. It must be served on the HTTPS response, otherwise an attacker on the first request could strip it.

Syntax & directives

max-age=<sec>
Required. How long (seconds) the browser remembers the HTTPS-only rule. 63072000 = 2 years is the common production value.
includeSubDomains
Applies the policy to every subdomain. Only set once you are certain ALL subdomains serve HTTPS.
preload
Signals intent to be added to the browser preload list (see below). Requires max-age ≥ 31536000 and includeSubDomains.
HTTP RESPONSE HEADER
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

The preload list

Adding preload and submitting your domain at hstspreload.org hard-codes the HTTPS-only rule into the browser itself, so even the very first request is protected. This is powerful but hard to reverse — removal from the list can take months to propagate. Only preload once every subdomain, forever, will serve HTTPS.

Why it matters

  • It defeats SSL-stripping man-in-the-middle attacks, where an attacker downgrades a victim's connection to HTTP to read or modify traffic.
  • It protects secure cookies: without HSTS a single http:// request can leak a session cookie before the redirect to HTTPS happens.
  • The automatic http→https upgrade removes a redirect round-trip, so HSTS is a small performance win as well as a security control.

Common mistakes

  • Setting a tiny max-age (e.g. a few minutes) 'to be safe' — the protection window is then almost meaningless. Ramp up to a large value instead.
  • Adding includeSubDomains before every subdomain supports HTTPS, which instantly breaks any HTTP-only subdomain (e.g. a legacy dev host).
  • Submitting to preload prematurely — reversing it is slow and painful if a subdomain still needs HTTP.
  • Serving the header only over HTTP, where browsers ignore it entirely.

How WebInspect checks this

  • WebInspect reads Strict-Transport-Security on the HTTPS response and flags its absence on any TLS-enabled site.
  • It parses max-age and warns when the value is too short to be meaningful, and notes whether includeSubDomains and preload are present.
  • It cross-checks that HTTP requests actually redirect to HTTPS, so a present header on a non-redirecting site is called out.